Fix JSON::ParserError escaping safe_parse in DiscussionsDiff::HighlightCache

Patrick Bajaorequested to merge
601142-fix-json-parser-error-highlight-cache into master

What does this MR do and why?

HighlightCache#read_multiple calls Gitlab::Json.safe_parse to deserialize cached diff lines. The default max_total_elements: 100_000 limit causes JSON::ParserError: Too many total parameters for large diff hunks, crashing the Projects::MergeRequestsController#discussions request.

We only experience it now due to this change made a couple of months ago that changed the call from Gitlab::Json.parse to Gitlab::Json.safe_parse: !221163 (merged).

A NoteDiffFile stores all diff lines up to the commented line (diff_hunk), so a note placed late in a large file produces a hunk with thousands of lines. Each Gitlab::Diff::Line serializes to 7 keys (~15 JSON elements), meaning ~6,666 lines is enough to exceed the limit.

The fix passes parse_limits: { max_total_elements: 0 } to disable only the element count check. This is safe because:

  • Diff content is already bounded upstream by patch_hard_limit_bytes (default 200KB, max 500KB). A diff exceeding the hard byte limit is pruned and cannot be commented on.
  • All other safe_parse limits remain active: max_depth, max_array_size, max_hash_size, and max_json_size_bytes.

References

Edited by Patrick Bajao

Merge request reports